Executive brief
A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem allows a preemptible program to cause an out-of-bounds memory write when collecting stack traces. An attacker can exploit this by scheduling a BPF program that consumes a shared per-CPU buffer concurrently with another task, leading to buffer overflow and potential code execution or system crash.
Technical details
The vulnerability exists in the __bpf_get_stack() function, which retrieves a per-CPU perf_callchain_entry buffer via get_perf_callchain() and then releases the recursion slot before consuming it. On preemptible kernels (PREEMPT or PREEMPT_RCU configurations), a BPF program running under migrate_disable() but not preempt_disable() can be scheduled out while holding the buffer reference. Another task on the same CPU can then reuse the same per-CPU buffer and inflate trace->nr, causing copy_len to exceed the caller's buffer bounds. This results in an out-of-bounds write via memcpy() and build ID resolution. The fix disables preemption around buffer acquisition and copying, ensuring the entry cannot be reused until the private copy is complete; Build ID resolution is deferred until after preemption is re-enabled.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-11: disclosed